cloudtrail

package
v1.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 19, 2026 License: MIT Imports: 21 Imported by: 0

README

CloudTrail

Parity grade: A · SDK aws-sdk-go-v2/service/cloudtrail@v1.55.7 · last audited 2026-07-12 (174b1f53)

Coverage
Operations audited 60 (52 ok, 8 partial)
Known gaps 5
Deferred items 2
Resource leaks clean
Known gaps
  • ListTrails/ListChannels/ListDashboards/ListImports/ListQueries/ListEventDataStores accept NextToken in the real API but this backend always returns every item in one page (no pagination). Low risk for typical emulator-scale resource counts but a real SDK client passing NextToken from a previous (different) call gets ignored rather than erroring.
  • LookupEvents ignores the EventCategory input field (only 'Insight' is a valid non-default value upstream); harmless today since this backend never synthesizes Insight-category events, but if a synthetic-Insights feature is ever added this filter needs wiring.
  • StartImport's ImportSource.S3 only models S3LocationUri; S3BucketRegion and S3BucketAccessRoleArn are accepted on the wire but never stored/echoed. Import execution itself is not real (no actual file replay), so this is a low-priority simplification.
  • RegisterOrganizationDelegatedAdmin / DeregisterOrganizationDelegatedAdmin validate input but track no org-admin state (no GetOrganizationDelegatedAdmins-equivalent op exists in gopherstack's CloudTrail service to read it back anyway).
  • PARITY-FOLLOWUP (pkgs/service, out of scope for this service): pkgs/service/cloudtrail_capture.go's wrapCloudTrailCapture records a management event unconditionally after next(c) returns, regardless of the wrapped handler's response status — a failed (4xx/5xx) mutating API call is captured identically to a successful one, and the synthesized CloudTrailEvent detail JSON always sets errorCode/errorMessage-equivalent fields absent (no error info at all). Real CloudTrail records failed calls too, but with populated errorCode/errorMessage. Not broken (chokepoint IS wired correctly end-to-end: RecordManagementEvent -> InMemoryBackend.RecordManagementEvent -> LookupEvents returns real captured events), just an accuracy gap in a shared file outside services/cloudtrail/'s edit scope.
Deferred
  • CloudTrail Lake SQL query execution (StartQuery/GetQueryResults actually evaluating QueryStatement against recorded events) — QueryResultRows is always empty by design; a real implementation would need a SQL-subset interpreter against the events log.
  • Dashboard Widgets modeling (CreateDashboard/GetDashboard/UpdateDashboard accept but do not model/store the Widgets list).

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrNotFound is returned when the requested resource does not exist.
	ErrNotFound = awserr.New("TrailNotFoundException", awserr.ErrNotFound)
	// ErrAlreadyExists is returned when a resource already exists.
	ErrAlreadyExists = awserr.New("TrailAlreadyExistsException", awserr.ErrConflict)
	// ErrValidation is returned when input validation fails.
	ErrValidation = awserr.New("InvalidParameterException", awserr.ErrInvalidParameter)
	// ErrChannelNotFound is returned when a channel is not found.
	ErrChannelNotFound = awserr.New("ChannelNotFoundException", awserr.ErrNotFound)
	// ErrDashboardNotFound is returned when a dashboard is not found.
	ErrDashboardNotFound = awserr.New("DashboardNotFoundException", awserr.ErrNotFound)
	// ErrEventDataStoreNotFound is returned when an event data store is not found.
	ErrEventDataStoreNotFound = awserr.New("EventDataStoreNotFoundException", awserr.ErrNotFound)
	// ErrQueryNotFound is returned when a query is not found.
	ErrQueryNotFound = awserr.New("InactiveQueryException", awserr.ErrNotFound)
	// ErrTerminationProtected is returned when trying to delete a termination-protected resource.
	ErrTerminationProtected = awserr.New("EventDataStoreTerminationProtectedException", awserr.ErrConflict)
	// ErrInsightNotEnabled is returned when GetInsightSelectors is called on a trail with no
	// insight selectors configured. AWS returns InsightNotEnabledException in this case.
	ErrInsightNotEnabled = awserr.New("InsightNotEnabledException", awserr.ErrInvalidParameter)
)

Functions

This section is empty.

Types

type AdvancedEventSelector 

type AdvancedEventSelector struct {
	Name           string                  `json:"Name,omitempty"`
	FieldSelectors []AdvancedFieldSelector `json:"FieldSelectors"`
}

AdvancedEventSelector represents an advanced event selector that filters events based on field-level conditions. Mutually exclusive with basic EventSelectors.

type AdvancedFieldSelector 

type AdvancedFieldSelector struct {
	Field         string   `json:"Field"`
	Equals        []string `json:"Equals,omitempty"`
	StartsWith    []string `json:"StartsWith,omitempty"`
	EndsWith      []string `json:"EndsWith,omitempty"`
	NotEquals     []string `json:"NotEquals,omitempty"`
	NotStartsWith []string `json:"NotStartsWith,omitempty"`
	NotEndsWith   []string `json:"NotEndsWith,omitempty"`
}

AdvancedFieldSelector represents a filter condition in an advanced event selector. Each field selector specifies a field name and one or more comparison operators.

type Channel 

type Channel struct {
	Tags         *tags.Tags    `json:"tags,omitempty"`
	ChannelID    string        `json:"channelId"`
	ChannelARN   string        `json:"channelArn"`
	Name         string        `json:"name"`
	Source       string        `json:"source"`
	Destinations []Destination `json:"destinations,omitempty"`
}

Channel represents a CloudTrail channel resource.

type Dashboard 

type Dashboard struct {
	Tags         *tags.Tags `json:"tags,omitempty"`
	DashboardID  string     `json:"dashboardId"`
	DashboardARN string     `json:"dashboardArn"`
	Name         string     `json:"name"`
	Type         string     `json:"type"`
	Status       string     `json:"status"`
}

Dashboard represents a CloudTrail dashboard resource.

type DataResource 

type DataResource struct {
	Type   string   `json:"Type"`
	Values []string `json:"Values"`
}

DataResource represents a resource type for event selector data resources.

type Destination 

type Destination struct {
	Type     string `json:"Type"`
	Location string `json:"Location"`
}

Destination represents a channel destination.

type Event 

type Event struct {
	EventTime   time.Time `json:"EventTime"`
	EventID     string    `json:"EventId"`
	EventName   string    `json:"EventName"`
	EventSource string    `json:"EventSource"`
	Username    string    `json:"Username,omitempty"`
	ReadOnly    string    `json:"ReadOnly,omitempty"`
	AccessKeyID string    `json:"AccessKeyId,omitempty"`
	// CloudTrailEvent is the full JSON-encoded event record (eventVersion,
	// userIdentity, eventTime, eventSource, eventName, awsRegion, requestID,
	// eventID, readOnly, eventType, managementEvent, eventCategory, ...),
	// matching the shape AWS embeds as a JSON string in LookupEvents results.
	CloudTrailEvent string          `json:"CloudTrailEvent,omitempty"`
	Resources       []EventResource `json:"Resources,omitempty"`
}

Event represents a recorded management or data event.

func (Event) MarshalJSON 

func (e Event) MarshalJSON() ([]byte, error)

MarshalJSON renders Event in the AWS JSON-protocol wire format. LookupEvents is a JSON-protocol operation whose EventTime shape is a unixTimestamp, so the SDK deserializer requires a JSON number of seconds since the epoch (see pkgs/awstime) rather than encoding/json's default RFC3339 string.

type EventConfiguration 

type EventConfiguration struct {
	MaxEventSize              string           `json:"maxEventSize,omitempty"`
	AggregationConfigurations []map[string]any `json:"aggregationConfigurations,omitempty"`
	ContextKeySelectors       []map[string]any `json:"contextKeySelectors,omitempty"`
}

EventConfiguration holds the event-aggregation and enriched-context settings for a single trail or event data store (keyed by its ARN). AggregationConfigurations and ContextKeySelectors are stored as generic maps (rather than fully modeled types) because the backend only needs to persist and echo back exactly what the caller configured -- CloudTrail itself does not evaluate aggregation templates or context key matches.

type EventDataStore 

type EventDataStore struct {
	Tags                   *tags.Tags              `json:"tags,omitempty"`
	CreatedTimestamp       time.Time               `json:"createdTimestamp"`
	UpdatedTimestamp       time.Time               `json:"updatedTimestamp"`
	EventDataStoreID       string                  `json:"eventDataStoreId"`
	EventDataStoreARN      string                  `json:"eventDataStoreArn"`
	Name                   string                  `json:"name"`
	Status                 string                  `json:"status"`
	FederationStatus       string                  `json:"federationStatus,omitempty"`
	FederationRoleArn      string                  `json:"federationRoleArn,omitempty"`
	BillingMode            string                  `json:"billingMode,omitempty"`
	KMSKeyID               string                  `json:"kmsKeyId,omitempty"`
	AdvancedEventSelectors []AdvancedEventSelector `json:"advancedEventSelectors,omitempty"`
	InsightSelectors       []InsightSelector       `json:"insightSelectors,omitempty"`
	RetentionPeriod        int32                   `json:"retentionPeriod"`
	MultiRegionEnabled     bool                    `json:"multiRegionEnabled"`
	OrganizationEnabled    bool                    `json:"organizationEnabled"`
	TerminationProtected   bool                    `json:"terminationProtectionEnabled"`
}

EventDataStore represents a CloudTrail event data store resource.

type EventResource 

type EventResource struct {
	ResourceName string `json:"ResourceName,omitempty"`
	ResourceType string `json:"ResourceType,omitempty"`
}

EventResource represents a resource associated with a CloudTrail event.

type EventSelector 

type EventSelector struct {
	ReadWriteType           string         `json:"ReadWriteType"`
	DataResources           []DataResource `json:"DataResources"`
	IncludeManagementEvents bool           `json:"IncludeManagementEvents"`
}

EventSelector represents a CloudTrail event selector.

type GeneratedQuery 

type GeneratedQuery struct {
	QueryStatement string
	QueryAlias     string
	OwnerAccountID string
}

GeneratedQuery holds the result of a GenerateQuery call: a synthesized CloudTrail Lake SQL statement (and alias) for a natural-language prompt. Unlike StartQuery, GenerateQuery does not create a persisted, runnable query record -- AWS only returns the generated statement text.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for AWS CloudTrail operations (JSON-1.1 protocol).

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a new CloudTrail handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this CloudTrail instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the CloudTrail operation name from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(_ *echo.Context) string

ExtractResource extracts the primary resource identifier from the request body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported CloudTrail operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for CloudTrail requests.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) RecordManagementEvent 

func (h *Handler) RecordManagementEvent(ev service.CloudTrailEventInput)

RecordManagementEvent implements service.CloudTrailRecorder, allowing the central service registry to reach this live backend directly (no second, disconnected CloudTrail backend is created).

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears the backend state (test helper).

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches AWS CloudTrail JSON requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

type Import 

type Import struct {
	CreatedTimestamp time.Time `json:"createdTimestamp"`
	UpdatedTimestamp time.Time `json:"updatedTimestamp"`
	ImportID         string    `json:"importId"`
	ImportSource     string    `json:"importSource,omitempty"`
	ImportStatus     string    `json:"importStatus"`
	Destinations     []string  `json:"destinations,omitempty"`
}

Import represents a CloudTrail import resource.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for CloudTrail resources.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new in-memory CloudTrail backend.

func (*InMemoryBackend) AddTags 

func (b *InMemoryBackend) AddTags(resourceID string, kv map[string]string) error

AddTags adds tags to a resource by ARN or ID.

func (*InMemoryBackend) CancelQuery 

func (b *InMemoryBackend) CancelQuery(queryID string) (*Query, error)

CancelQuery cancels a running query.

func (*InMemoryBackend) CreateChannel 

func (b *InMemoryBackend) CreateChannel(
	name, source string,
	destinations []Destination,
	kv map[string]string,
) (*Channel, error)

CreateChannel creates a new CloudTrail channel.

func (*InMemoryBackend) CreateDashboard 

func (b *InMemoryBackend) CreateDashboard(name, dashType string, kv map[string]string) (*Dashboard, error)

CreateDashboard creates a new CloudTrail dashboard.

func (*InMemoryBackend) CreateEventDataStore 

func (b *InMemoryBackend) CreateEventDataStore(
	name string,
	multiRegionEnabled, organizationEnabled, terminationProtected bool,
	retentionPeriod int32,
	advancedEventSelectors []AdvancedEventSelector,
	billingMode, kmsKeyID string,
	kv map[string]string,
) (*EventDataStore, error)

CreateEventDataStore creates a new CloudTrail event data store.

func (*InMemoryBackend) CreateTrail 

func (b *InMemoryBackend) CreateTrail(
	name, s3BucketName, s3KeyPrefix, snsTopicName,
	cloudWatchLogsLogGroupARN, cloudWatchLogsRoleARN, kmsKeyID string,
	includeGlobalServiceEvents, isMultiRegionTrail, enableLogFileValidation bool,
	kv map[string]string,
) (*Trail, error)

CreateTrail creates a new CloudTrail trail.

func (*InMemoryBackend) DeleteChannel 

func (b *InMemoryBackend) DeleteChannel(channelIDOrARN string) error

DeleteChannel deletes a channel by ID or ARN.

func (*InMemoryBackend) DeleteDashboard 

func (b *InMemoryBackend) DeleteDashboard(dashboardIDOrARN string) error

DeleteDashboard deletes a dashboard by ID or ARN.

func (*InMemoryBackend) DeleteEventDataStore 

func (b *InMemoryBackend) DeleteEventDataStore(edsIDOrARN string) error

DeleteEventDataStore deletes an event data store by ID or ARN. Returns ErrTerminationProtected if termination protection is enabled.

func (*InMemoryBackend) DeleteResourcePolicy 

func (b *InMemoryBackend) DeleteResourcePolicy(resourceARN string) error

DeleteResourcePolicy removes the resource-based policy from a CloudTrail resource.

func (*InMemoryBackend) DeleteTrail 

func (b *InMemoryBackend) DeleteTrail(nameOrARN string) error

DeleteTrail deletes a trail by name or ARN.

func (*InMemoryBackend) DeregisterOrganizationDelegatedAdmin 

func (b *InMemoryBackend) DeregisterOrganizationDelegatedAdmin(delegatedAdminAccountID string) error

DeregisterOrganizationDelegatedAdmin deregisters an organization delegated admin account. This is a no-op in the in-memory backend (returns success).

func (*InMemoryBackend) DescribeQuery 

func (b *InMemoryBackend) DescribeQuery(queryID string) (*Query, error)

DescribeQuery returns details about a specific query.

func (*InMemoryBackend) DescribeTrails 

func (b *InMemoryBackend) DescribeTrails(nameList []string) []*Trail

DescribeTrails returns trails matching the given name list. If nameList is empty, all trails are returned.

func (*InMemoryBackend) DisableFederation 

func (b *InMemoryBackend) DisableFederation(edsIDOrARN string) (*EventDataStore, error)

DisableFederation disables federation for an event data store.

func (*InMemoryBackend) EnableFederation 

func (b *InMemoryBackend) EnableFederation(edsIDOrARN, federationRoleArn string) (*EventDataStore, error)

EnableFederation enables federation for an event data store, storing the role ARN.

func (*InMemoryBackend) GenerateQuery 

func (b *InMemoryBackend) GenerateQuery(eventDataStores []string, prompt string) *GeneratedQuery

GenerateQuery synthesizes a CloudTrail Lake SQL query statement from a natural-language prompt against the given event data stores.

func (*InMemoryBackend) GetChannel 

func (b *InMemoryBackend) GetChannel(channelIDOrARN string) (*Channel, error)

GetChannel returns a channel by ID or ARN.

func (*InMemoryBackend) GetDashboard 

func (b *InMemoryBackend) GetDashboard(dashIDOrARN string) (*Dashboard, error)

GetDashboard returns a dashboard by ID or ARN.

func (*InMemoryBackend) GetEDSInsightSelectors 

func (b *InMemoryBackend) GetEDSInsightSelectors(edsIDOrARN string) (string, []InsightSelector, error)

GetEDSInsightSelectors returns insight selectors for an event data store. AWS returns InsightNotEnabledException when no insight selectors are configured.

func (*InMemoryBackend) GetEventConfiguration 

func (b *InMemoryBackend) GetEventConfiguration(resourceARN string) *EventConfiguration

GetEventConfiguration returns the event configuration for a trail or event data store ARN. AWS returns an empty configuration when none has been set.

func (*InMemoryBackend) GetEventDataStore 

func (b *InMemoryBackend) GetEventDataStore(edsIDOrARN string) (*EventDataStore, error)

GetEventDataStore returns an event data store by ID or ARN.

func (*InMemoryBackend) GetEventSelectors 

func (b *InMemoryBackend) GetEventSelectors(
	nameOrARN string,
) (string, []EventSelector, []AdvancedEventSelector, error)

GetEventSelectors returns both basic and advanced event selectors for a trail.

func (*InMemoryBackend) GetImport 

func (b *InMemoryBackend) GetImport(importID string) (*Import, error)

GetImport returns an import by ID.

func (*InMemoryBackend) GetInsightSelectors 

func (b *InMemoryBackend) GetInsightSelectors(trailNameOrARN string) (string, []InsightSelector, error)

GetInsightSelectors returns insight selectors for a trail. AWS returns InsightNotEnabledException when no insight selectors are configured.

func (*InMemoryBackend) GetQueryResults 

func (b *InMemoryBackend) GetQueryResults(queryID string) (*Query, error)

GetQueryResults returns results for a completed query (stub returns empty rows).

func (*InMemoryBackend) GetResourcePolicy 

func (b *InMemoryBackend) GetResourcePolicy(resourceARN string) (*ResourcePolicy, error)

GetResourcePolicy returns the resource policy for the given ARN.

func (*InMemoryBackend) GetTrail 

func (b *InMemoryBackend) GetTrail(nameOrARN string) (*Trail, error)

GetTrail returns a trail by name or ARN.

func (*InMemoryBackend) GetTrailStatus 

func (b *InMemoryBackend) GetTrailStatus(nameOrARN string) (*Trail, error)

GetTrailStatus returns the full logging status of a trail.

func (*InMemoryBackend) ListChannels 

func (b *InMemoryBackend) ListChannels() []*Channel

ListChannels returns all channels.

func (*InMemoryBackend) ListDashboards 

func (b *InMemoryBackend) ListDashboards() []*Dashboard

ListDashboards returns all dashboards.

func (*InMemoryBackend) ListEventDataStores 

func (b *InMemoryBackend) ListEventDataStores() []*EventDataStore

ListEventDataStores returns all event data stores.

func (*InMemoryBackend) ListImportFailures 

func (b *InMemoryBackend) ListImportFailures(_ string) []map[string]any

ListImportFailures returns empty import failures (stub).

func (*InMemoryBackend) ListImports 

func (b *InMemoryBackend) ListImports() []*Import

ListImports returns all imports.

func (*InMemoryBackend) ListInsightsData 

func (b *InMemoryBackend) ListInsightsData() []map[string]any

ListInsightsData returns empty insights data (stub).

func (*InMemoryBackend) ListInsightsMetricData 

func (b *InMemoryBackend) ListInsightsMetricData() []map[string]any

ListInsightsMetricData returns empty insights metric data (stub).

func (*InMemoryBackend) ListPublicKeys 

func (b *InMemoryBackend) ListPublicKeys() []map[string]any

ListPublicKeys returns empty public keys (stub).

func (*InMemoryBackend) ListQueries 

func (b *InMemoryBackend) ListQueries() []*Query

ListQueries returns all queries.

func (*InMemoryBackend) ListTags 

func (b *InMemoryBackend) ListTags(resourceIDs []string) map[string]map[string]string

ListTags returns tags for the given resource ARNs or IDs.

func (*InMemoryBackend) ListTrails 

func (b *InMemoryBackend) ListTrails() []*Trail

ListTrails returns all trails.

func (*InMemoryBackend) LookupEvents 

func (b *InMemoryBackend) LookupEvents(input LookupEventsInput) LookupEventsOutput

LookupEvents returns recorded events matching the given filters. Events are returned newest-first (matching AWS) and honor StartTime/EndTime, the lookup attributes (ANDed together), MaxResults, and NextToken pagination.

func (*InMemoryBackend) PutEDSInsightSelectors 

func (b *InMemoryBackend) PutEDSInsightSelectors(
	edsIDOrARN string,
	selectors []InsightSelector,
) (*EventDataStore, error)

PutEDSInsightSelectors sets insight selectors for an event data store.

func (*InMemoryBackend) PutEventConfiguration 

func (b *InMemoryBackend) PutEventConfiguration(
	resourceARN string,
	aggregationConfigurations, contextKeySelectors []map[string]any,
	maxEventSize string,
) *EventConfiguration

PutEventConfiguration sets the event configuration for a trail or event data store ARN.

func (*InMemoryBackend) PutEventSelectors 

func (b *InMemoryBackend) PutEventSelectors(
	nameOrARN string,
	selectors []EventSelector,
	advancedSelectors []AdvancedEventSelector,
) (*Trail, error)

PutEventSelectors sets event selectors for a trail. Basic and advanced selectors are mutually exclusive: providing AdvancedEventSelectors clears EventSelectors and vice versa.

func (*InMemoryBackend) PutInsightSelectors 

func (b *InMemoryBackend) PutInsightSelectors(trailNameOrARN string, selectors []InsightSelector) (*Trail, error)

PutInsightSelectors sets insight selectors for a trail, updating HasInsightSelectors.

func (*InMemoryBackend) PutResourcePolicy 

func (b *InMemoryBackend) PutResourcePolicy(resourceARN, policy string) *ResourcePolicy

PutResourcePolicy sets the resource policy for the given ARN.

func (*InMemoryBackend) RecordEvent 

func (b *InMemoryBackend) RecordEvent(ev Event)

RecordEvent stores a management/data event so it can later be returned by LookupEvents. The event is assigned an EventID and EventTime if not already set.

func (*InMemoryBackend) RecordManagementEvent 

func (b *InMemoryBackend) RecordManagementEvent(ev service.CloudTrailEventInput)

RecordManagementEvent implements service.CloudTrailRecorder. It is invoked by the central service registry (pkgs/service.Registry) after every mutating API call made against any registered emulator service. This is what turns the previously-unused RecordEvent path into a real, globally wired CloudTrail capture point (the LocalStack model: CloudTrail records mutating control-plane calls regardless of which service handled them), so LookupEvents returns genuine activity instead of always being empty.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the AWS region this backend is configured for.

func (*InMemoryBackend) RegisterOrganizationDelegatedAdmin 

func (b *InMemoryBackend) RegisterOrganizationDelegatedAdmin(accountID string) error

RegisterOrganizationDelegatedAdmin is a no-op that registers an org delegated admin.

func (*InMemoryBackend) RemoveTags 

func (b *InMemoryBackend) RemoveTags(resourceID string, keys []string) error

RemoveTags removes tags from a resource by ARN or ID.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state in the backend.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) RestoreEventDataStore 

func (b *InMemoryBackend) RestoreEventDataStore(edsIDOrARN string) (*EventDataStore, error)

RestoreEventDataStore restores a deleted event data store (sets status to ENABLED).

func (*InMemoryBackend) SearchSampleQueries 

func (b *InMemoryBackend) SearchSampleQueries() []map[string]any

SearchSampleQueries returns empty sample queries (stub).

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) StartDashboardRefresh 

func (b *InMemoryBackend) StartDashboardRefresh(dashIDOrARN string) (*Dashboard, error)

StartDashboardRefresh triggers a refresh of a dashboard (sets status to REFRESHING).

func (*InMemoryBackend) StartEventDataStoreIngestion 

func (b *InMemoryBackend) StartEventDataStoreIngestion(edsIDOrARN string) error

StartEventDataStoreIngestion starts ingestion for an event data store.

func (*InMemoryBackend) StartImport 

func (b *InMemoryBackend) StartImport(destinations []string, importSource string) (*Import, error)

StartImport creates an import job.

func (*InMemoryBackend) StartLogging 

func (b *InMemoryBackend) StartLogging(nameOrARN string) error

StartLogging sets the isLogging flag for a trail to true and records the start time.

func (*InMemoryBackend) StartQuery 

func (b *InMemoryBackend) StartQuery(queryString, edsARN, deliveryS3URI string) (*Query, error)

StartQuery creates a new query against an event data store.

func (*InMemoryBackend) StopEventDataStoreIngestion 

func (b *InMemoryBackend) StopEventDataStoreIngestion(edsIDOrARN string) error

StopEventDataStoreIngestion stops ingestion for an event data store.

func (*InMemoryBackend) StopImport 

func (b *InMemoryBackend) StopImport(importID string) (*Import, error)

StopImport stops an in-progress import.

func (*InMemoryBackend) StopLogging 

func (b *InMemoryBackend) StopLogging(nameOrARN string) error

StopLogging sets the isLogging flag for a trail to false and records the stop time.

func (*InMemoryBackend) UpdateChannel 

func (b *InMemoryBackend) UpdateChannel(
	channelIDOrARN, name string,
	destinations []Destination,
) (*Channel, error)

UpdateChannel updates an existing channel's name and/or destinations.

func (*InMemoryBackend) UpdateDashboard 

func (b *InMemoryBackend) UpdateDashboard(dashIDOrARN string, name string) (*Dashboard, error)

UpdateDashboard updates an existing dashboard.

func (*InMemoryBackend) UpdateEventDataStore 

func (b *InMemoryBackend) UpdateEventDataStore(
	edsIDOrARN string,
	name string,
	multiRegionEnabled, organizationEnabled, terminationProtected *bool,
	retentionPeriod *int32,
	advancedEventSelectors []AdvancedEventSelector,
	billingMode, kmsKeyID string,
) (*EventDataStore, error)

UpdateEventDataStore updates an existing event data store.

func (*InMemoryBackend) UpdateTrail 

func (b *InMemoryBackend) UpdateTrail(
	name, s3BucketName, s3KeyPrefix, snsTopicName,
	cloudWatchLogsLogGroupARN, cloudWatchLogsRoleARN, kmsKeyID string,
	includeGlobalServiceEvents, isMultiRegionTrail, enableLogFileValidation *bool,
) (*Trail, error)

UpdateTrail updates an existing trail's configuration.

type InsightSelector 

type InsightSelector struct {
	InsightType string `json:"InsightType"`
}

InsightSelector represents a CloudTrail insight selector.

type LookupAttribute 

type LookupAttribute struct {
	AttributeKey   string `json:"AttributeKey"`
	AttributeValue string `json:"AttributeValue"`
}

LookupAttribute represents a filter attribute for LookupEvents.

type LookupEventsInput 

type LookupEventsInput struct {
	StartTime        *time.Time
	EndTime          *time.Time
	NextToken        string
	LookupAttributes []LookupAttribute
	MaxResults       int32
}

LookupEventsInput holds parameters for a LookupEvents call.

type LookupEventsOutput 

type LookupEventsOutput struct {
	NextToken string
	Events    []Event
}

LookupEventsOutput holds the result of a LookupEvents call.

type Provider 

type Provider struct{}

Provider implements service.Provider for AWS CloudTrail.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the CloudTrail service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type Query 

type Query struct {
	CreationTime      time.Time `json:"creationTime"`
	QueryID           string    `json:"queryId"`
	EventDataStoreARN string    `json:"eventDataStoreArn"`
	QueryString       string    `json:"queryString"`
	QueryStatus       string    `json:"queryStatus"`
	DeliveryS3URI     string    `json:"deliveryS3Uri,omitempty"`
	ErrorMessage      string    `json:"errorMessage,omitempty"`
}

Query represents a CloudTrail query resource.

type ResourcePolicy 

type ResourcePolicy struct {
	ResourceARN    string `json:"resourceArn"`
	ResourcePolicy string `json:"resourcePolicy"`
}

ResourcePolicy represents a resource-based policy attached to a CloudTrail resource.

type Trail 

type Trail struct {
	CreationTime               time.Time               `json:"creationTime"`
	StartLoggingTime           *time.Time              `json:"startLoggingTime,omitempty"`
	StopLoggingTime            *time.Time              `json:"stopLoggingTime,omitempty"`
	LatestDeliveryTime         *time.Time              `json:"latestDeliveryTime,omitempty"`
	Tags                       *tags.Tags              `json:"tags,omitempty"`
	KMSKeyID                   string                  `json:"kmsKeyId,omitempty"`
	TrailARN                   string                  `json:"trailArn"`
	S3BucketName               string                  `json:"s3BucketName"`
	S3KeyPrefix                string                  `json:"s3KeyPrefix,omitempty"`
	SnsTopicName               string                  `json:"snsTopicName,omitempty"`
	SnsTopicARN                string                  `json:"snsTopicArn,omitempty"`
	CloudWatchLogsLogGroupARN  string                  `json:"cloudWatchLogsLogGroupArn,omitempty"`
	CloudWatchLogsRoleARN      string                  `json:"cloudWatchLogsRoleArn,omitempty"`
	Region                     string                  `json:"region"`
	Name                       string                  `json:"name"`
	HomeRegion                 string                  `json:"homeRegion"`
	AccountID                  string                  `json:"accountId"`
	EventSelectors             []EventSelector         `json:"eventSelectors,omitempty"`
	AdvancedEventSelectors     []AdvancedEventSelector `json:"advancedEventSelectors,omitempty"`
	InsightSelectors           []InsightSelector       `json:"insightSelectors,omitempty"`
	IncludeGlobalServiceEvents bool                    `json:"includeGlobalServiceEvents"`
	IsMultiRegionTrail         bool                    `json:"isMultiRegionTrail"`
	LogFileValidationEnabled   bool                    `json:"logFileValidationEnabled"`
	IsLogging                  bool                    `json:"isLogging"`
	HasCustomEventSelectors    bool                    `json:"hasCustomEventSelectors"`
	HasInsightSelectors        bool                    `json:"hasInsightSelectors"`
	IsOrganizationTrail        bool                    `json:"isOrganizationTrail"`
}

Trail represents an AWS CloudTrail trail.

The Tags field is backend-owned. Callers must treat the returned pointer as read-only; mutate tags only via AddTags / CreateTrail.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.